CVE-2025-32836: Siemens Telecontrol Server Basic SQL Injection

CVE-2025-32836 Overview

CVE-2025-32836 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used GetConnectionVariables method, which fails to properly sanitize input passed to backend database queries.

An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and modify database contents, and execute arbitrary code under the NT AUTHORITY\NetworkService account. The vulnerability impacts confidentiality, integrity, and availability of the affected industrial control system component.

Critical Impact
Authenticated attackers can achieve remote code execution as NT AUTHORITY\NetworkService on Siemens TeleControl Server Basic systems exposing port 8000.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Vendor: Siemens
Component: siemens:telecontrol_server_basic

Discovery Timeline

2025-04-16 - CVE-2025-32836 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32836

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] within the internal GetConnectionVariables method of TeleControl Server Basic. The method incorporates user-controlled values into database queries without proper parameterization or input validation.

Because the injection occurs in an internal method reachable through the authenticated TCP port 8000 interface, attackers can manipulate query logic to bypass server-side authorization checks. The TeleControl Server runs under the NT AUTHORITY\NetworkService account, so query-based command execution inherits those privileges. This allows attackers to pivot from database manipulation into operating system code execution on the host.

Root Cause

The GetConnectionVariables method concatenates attacker-controlled input directly into SQL statements rather than using parameterized queries. The application also relies on these queries to enforce authorization, so a successful injection simultaneously breaks the access control model and the data layer. Refer to the Siemens Security Advisory SSA-443402 for vendor-confirmed technical details.

Attack Vector

Exploitation requires network access to TCP port 8000 on the host running TeleControl Server Basic and a valid (low-privilege) authenticated session. The attacker sends crafted requests that invoke the GetConnectionVariables code path with malicious SQL payloads. Successful exploitation yields database read/write access and the ability to execute code as NT AUTHORITY\NetworkService, which on industrial control networks can be used to disrupt telecontrol operations or pivot deeper into operational technology (OT) environments.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-32836

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running under the NT AUTHORITY\NetworkService account.
Anomalous SQL statements in database logs containing union, stacked queries, or xp_cmdshell-style payloads originating from the TeleControl application user.
Inbound connections to TCP port 8000 from unexpected source addresses, particularly outside the engineering or control network segment.
New or modified database records, stored procedures, or accounts created by the TeleControl service identity.

Detection Strategies

Inspect application and database logs for malformed input reaching the GetConnectionVariables code path or query patterns containing SQL meta-characters.
Monitor process lineage on the TeleControl host for NetworkService spawning shell interpreters such as cmd.exe, powershell.exe, or wmic.exe.
Correlate authentication events on TeleControl Server with subsequent database write operations to identify low-privilege accounts performing privileged actions.

Monitoring Recommendations

Enable verbose query logging on the database backend used by TeleControl Server Basic and forward logs to a centralized SIEM.
Baseline normal traffic to TCP port 8000 and alert on connections from non-engineering subnets.
Track configuration changes and binary integrity on the TeleControl host to detect post-exploitation persistence.

How to Mitigate CVE-2025-32836

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens Security Advisory SSA-443402.
Restrict network access to TCP port 8000 to trusted engineering workstations using host and perimeter firewalls.
Audit all TeleControl Server accounts and disable or rotate credentials for unused or shared users.
Review database and Windows event logs since deployment for signs of prior exploitation.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which addresses CVE-2025-32836. Customers should apply this update on all affected installations. Patch availability and digital signatures are documented in the Siemens ProductCERT advisory SSA-443402.

Workarounds

Place the TeleControl Server in a segmented OT network with strict firewall rules limiting access to TCP port 8000.
Enforce least-privilege on TeleControl Server user accounts to reduce the impact of credential compromise.
Operate the system in line with Siemens' industrial security guidance and the IEC 62443 defense-in-depth recommendations until patching is complete.

bash

# Example Windows firewall rule restricting TCP/8000 to a trusted engineering subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.20.30.0/24
netsh advfirewall firewall add rule name="TeleControl-8000-Block-Other" ^
  dir=in action=block protocol=TCP localport=8000